rpminspect: Don't run annocheck on test binaries

[skip changelog]

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1,2 +1,4 @@
 /samba-*.tar.xz
 /samba-*.tar.asc
+/*.rpm
+/results_samba

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_stable
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

plans.fmf

@@ -0,0 +1,4 @@
+discover:
+    how: fmf
+execute:
+    how: tmt

rpminspect.yaml

@@ -4,6 +4,7 @@ inspections:
 
 badfuncs:
     ignore:
+        - /usr/bin/nmbd
         - /usr/bin/nmblookup
         - /usr/bin/smbtorture
         - /usr/lib*/libndr.so.*
@@ -25,3 +26,10 @@ abidiff:
 debuginfo:
     ignore:
         - /usr/lib*/libdcerpc-samr.so.*
+
+annocheck:
+    ignore:
+        - /usr/bin/gentest
+        - /usr/bin/locktest
+        - /usr/bin/masktest
+        - /usr/bin/smbtorture

samba-4.23-fix-cmocka.patch

@@ -0,0 +1,38 @@
+From b1ec803f420b2c6d3c5c83d70c6875a7f36b15fc Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@samba.org>
+Date: Fri, 21 Nov 2025 15:33:32 +0100
+Subject: [PATCH] s4:dsdb: Do not declare cm_print_error()
+
+This is part of the cmocka.h header file.
+
+Signed-off-by: Andreas Schneider <asn@samba.org>
+Reviewed-by: Martin Schwenke <martin@meltin.net>
+Reviewed-by: Volker Lendecke <vl@samba.org>
+
+Autobuild-User(master): Volker Lendecke <vl@samba.org>
+Autobuild-Date(master): Mon Nov 24 11:28:08 UTC 2025 on atb-devel-224
+
+(cherry picked from commit 5a981663e4f677042ba80191770100aecff2120a)
+---
+ source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
+index f7075f3485e..12c464b49c7 100644
+--- a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
++++ b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c
+@@ -103,11 +103,6 @@ void audit_message_send(
+ 
+ #define check_group_change_message(m, u, a, e)                                 \
+ 	_check_group_change_message(m, u, a, e, __FILE__, __LINE__);
+-/*
+- * declare the internal cmocka cm_print_error so that we can output messages
+- * in sub unit format
+- */
+-void cm_print_error(const char * const format, ...);
+ 
+ /*
+  * Validate a group change JSON audit message
+-- 
+2.52.0
+

samba.spec

@@ -6,7 +6,17 @@
 # or
 # rpmbuild --rebuild --with testsuite samba.src.rpm
 #
+# If you just want to run a single test, you can use:
+# fedpkg mockbuild --with testsuite -- --define 'SAMBA_TESTS regex' samba.src.rpm
+# or
+# rpmbuild --rebuild --with testsuite --define='SAMBA_TESTS regex' samba.src.rpm
+#
 %bcond testsuite 0
+%if %{with testsuite}
+# As the file list is empty for running just the tests, we have empty debuginfo
+# package. Disable it to avoid error reporting.
+%global debug_package %{nil}
+%endif
 
 # Build with internal talloc, tevent, tdb
 #
@@ -102,18 +112,32 @@
 
 # Build the etcd helpers by default on Fedora
 %if 0%{?fedora}
-%bcond etcd_mutex 1
+# disable etcd mutex helper as etcd is orphaned in Fedora now
+%bcond etcd_mutex 0
 %else
 %bcond etcd_mutex 0
 %endif
 
+# Build the prometheus exporter by default on Fedora
+%if 0%{?fedora}
+%bcond prometheus 1
+%else
+%bcond prometheus 0
+%endif
+
 %ifarch aarch64 ppc64le s390x x86_64 riscv64
 %bcond lmdb 1
 %else
 %bcond lmdb 0
 %endif
 
-%global samba_version 4.22.7
+%if 0%{?fedora} >= 43
+%bcond varlink 1
+%else
+%bcond varlink 0
+%endif
+
+%global samba_version 4.23.4
 
 # The release field is extended:
 # <pkgrel>[.<extraver>][.<snapinfo>]%%{?dist}[.<minorbump>]
@@ -159,8 +183,8 @@
 %global libwbclient_so_version 0
 
 %global talloc_version 2.4.3
-%global tdb_version 1.4.13
-%global tevent_version 0.16.2
+%global tdb_version 1.4.14
+%global tevent_version 0.17.1
 
 %global required_mit_krb5 1.20.1
 
@@ -215,9 +239,11 @@ Source18:       samba-winbind-systemd-sysusers.conf
 Source201:      README.downgrade
 Source202:      samba.abignore
 
+Patch0:         samba-4.23-fix-cmocka.patch
+
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-common-tools = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
@@ -314,6 +340,17 @@ BuildRequires: xz
 BuildRequires: zlib-devel >= 1.2.3
 
 BuildRequires: pkgconfig(libsystemd)
+# TODO FIXME This is not in RHEL yet
+%if 0%{?fedora} >= 43
+BuildRequires: pkgconfig(libngtcp2)
+BuildRequires: pkgconfig(libngtcp2_crypto_gnutls)
+%else
+Provides:      bundled(ngtcp2)
+%endif
+
+%if %{with varlink}
+BuildRequires: pkgconfig(libvarlink) >= 24
+%endif
 
 %ifnarch i686
 %if 0%{?fedora} >= 37
@@ -343,6 +380,9 @@ BuildRequires: librados-devel
 %if %{with etcd_mutex}
 BuildRequires: python3-etcd
 %endif
+%if %{with prometheus}
+BuildRequires: libevent-devel
+%endif
 
 BuildRequires: cepces-certmonger >= 0.3.8
 
@@ -425,7 +465,7 @@ Unix.
 Summary: Samba client programs
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 %if %{with libsmbclient}
@@ -448,12 +488,62 @@ The %{name}-client package provides some SMB/CIFS clients to complement
 the built-in SMB/CIFS filesystem in Linux. These clients allow access
 of SMB/CIFS shares and printing to SMB/CIFS printers.
 
+### CORE-LIBS
+%package core-libs
+Summary: Samba core libraries
+Requires(pre): %{name}-common = %{samba_depver}
+Requires: %{name}-common = %{samba_depver}
+
+Provides: bundled(libreplace) = %{samba_depver}
+
+%description core-libs
+The samba-core-libs package contains foundational libraries needed by
+both Samba servers and clients. This includes error handling, utilities,
+and basic support libraries.
+
+### NDR-LIBS
+%package ndr-libs
+Summary: Samba NDR libraries
+Requires(pre): %{name}-common = %{samba_depver}
+Requires: %{name}-common = %{samba_depver}
+Requires: %{name}-core-libs = %{samba_depver}
+
+Provides: %{name}-common-libs = %{samba_depver}
+Obsoletes: %{name}-common-libs < %{samba_depver}
+
+%if %{without dc} && %{without testsuite}
+Obsoletes: samba-dc < %{samba_depver}
+Obsoletes: samba-dc-libs < %{samba_depver}
+Obsoletes: samba-dc-bind-dlz < %{samba_depver}
+%endif
+
+# ctdb-tests package has been dropped if we do not build the testsuite
+%if %{with clustering}
+%if %{without testsuite}
+Obsoletes: ctdb-tests < %{samba_depver}
+Obsoletes: ctdb-tests-debuginfo < %{samba_depver}
+# endif without testsuite
+%endif
+# endif with clustering
+%endif
+
+# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions
+# of the distro
+%if %{without vfs_glusterfs}
+Obsoletes: samba-vfs-glusterfs < %{samba_depver}
+# endif without vfs_glusterfs
+%endif
+
+%description ndr-libs
+The samba-ndr-libs package contains NDR (Network Data Representation)
+encoding libraries used by both Samba servers and clients.
+
 ### CLIENT-LIBS
 %package client-libs
 Summary: Samba client libraries
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 %if %{with libwbclient}
 Requires: libwbclient = %{samba_depver}
@@ -483,50 +573,10 @@ Obsoletes: samba4-common < %{samba_depver}
 samba-common provides files necessary for both the server and client
 packages of Samba.
 
-### COMMON-LIBS
-%package common-libs
-Summary: Libraries used by both Samba servers and clients
-Requires(pre): samba-common = %{samba_depver}
-Requires: samba-common = %{samba_depver}
-Requires: %{name}-client-libs = %{samba_depver}
-Requires: libldb = %{samba_depver}
-%if %{with libwbclient}
-Requires: libwbclient = %{samba_depver}
-%endif
-
-Provides: bundled(libreplace) = %{samba_depver}
-
-%if %{without dc} && %{without testsuite}
-Obsoletes: samba-dc < %{samba_depver}
-Obsoletes: samba-dc-libs < %{samba_depver}
-Obsoletes: samba-dc-bind-dlz < %{samba_depver}
-%endif
-
-# ctdb-tests package has been dropped if we do not build the testsuite
-%if %{with clustering}
-%if %{without testsuite}
-Obsoletes: ctdb-tests < %{samba_depver}
-Obsoletes: ctdb-tests-debuginfo < %{samba_depver}
-# endif without testsuite
-%endif
-# endif with clustering
-%endif
-
-# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions
-# of the distro
-%if %{without vfs_glusterfs}
-Obsoletes: samba-vfs-glusterfs < %{samba_depver}
-# endif without vfs_glusterfs
-%endif
-
-%description common-libs
-The samba-common-libs package contains internal libraries needed by the
-SMB/CIFS clients.
-
 ### COMMON-TOOLS
 %package common-tools
 Summary: Tools for Samba clients
-Requires: samba-common-libs = %{samba_depver}
+Requires: samba-ndr-libs = %{samba_depver}
 Requires: samba-client-libs = %{samba_depver}
 Requires: samba-libs = %{samba_depver}
 Requires: samba-ldb-ldap-modules = %{samba_depver}
@@ -564,7 +614,7 @@ and for GPO management on domain members.
 ### RPC
 %package dcerpc
 Summary: DCE RPC binaries
-Requires: samba-common-libs = %{samba_depver}
+Requires: samba-ndr-libs = %{samba_depver}
 Requires: samba-client-libs = %{samba_depver}
 Requires: samba-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
@@ -582,7 +632,7 @@ The samba-dcerpc package contains binaries that serve DCERPC over named pipes.
 Summary: Samba AD Domain Controller
 Requires: %{name} = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-common-tools = %{samba_depver}
 Requires: %{name}-tools = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
@@ -626,7 +676,7 @@ The samba-dc-provision package provides files to setup a domain controller
 %package dc-libs
 Summary: Samba AD Domain Controller Libraries
 Requires: %{name}-client-libs = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
@@ -664,8 +714,10 @@ name server related details of Samba AD.
 ### DEVEL
 %package devel
 Summary: Developer tools for Samba libraries
-Requires: %{name}-libs = %{samba_depver}
+Requires: %{name}-core-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
+Requires: %{name}-libs = %{samba_depver}
 Requires: %{name}-dc-libs = %{samba_depver}
 Requires: libnetapi = %{samba_depver}
 
@@ -720,7 +772,7 @@ Summary: Samba VFS module for GlusterFS
 Requires: glusterfs-api >= 3.4.0.16
 Requires: glusterfs >= 3.4.0.16
 Requires: %{name} = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
@@ -771,7 +823,7 @@ the Kerberos credentials cache of the user issuing the print job.
 %package ldb-ldap-modules
 Summary: Samba ldap modules for ldb
 Requires: %{name}-client-libs = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 
@@ -782,7 +834,7 @@ samba-gpupdate.
 ### LIBS
 %package libs
 Summary: Samba libraries
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 %if %{with libwbclient}
@@ -803,7 +855,7 @@ against the SMB, RPC and other protocols provided by the Samba suite.
 Summary: The NETAPI library
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
@@ -825,7 +877,7 @@ develop programs that link against the NETAPI library in the Samba suite.
 Summary: The SMB client library
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 %if %{with libwbclient}
@@ -850,7 +902,7 @@ suite.
 %if %{with libwbclient}
 %package -n libwbclient
 Summary: The winbind client library
-Requires: %{name}-client-libs = %{samba_depver}
+# libwbclient.so only links to libc - no samba library dependencies needed
 Conflicts: sssd-libwbclient
 
 %description -n libwbclient
@@ -875,7 +927,7 @@ library.
 %package -n python3-%{name}
 Summary: Samba Python3 libraries
 Requires: %{name}-client-libs = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 Requires: %{name}-dc-libs = %{samba_depver}
 Requires: python3-cryptography
@@ -945,7 +997,7 @@ Requires: %{name} = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
 Requires: %{name}-winbind = %{samba_depver}
 
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 Requires: %{name}-test-libs = %{samba_depver}
@@ -976,7 +1028,7 @@ packages of Samba.
 ### TEST-LIBS
 %package test-libs
 Summary: Libraries need by the testing tools for Samba servers and clients
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
@@ -1009,8 +1061,8 @@ as a user using the `net usershare` command.
 Summary: Samba winbind
 Requires(pre): %{name}-common = %{samba_depver}
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
-Requires(post): %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
+Requires(post): %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-common-tools = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires(post): %{name}-client-libs = %{samba_depver}
@@ -1043,7 +1095,7 @@ Windows user and group accounts on Linux.
 %package winbind-clients
 Summary: Samba winbind clients
 Requires: %{name}-common = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 Requires: %{name}-winbind = %{samba_depver}
@@ -1113,7 +1165,7 @@ necessary to communicate to the Winbind Daemon
 Summary: Samba Winexe Windows Binary
 License: GPL-3.0-only
 Requires: %{name}-client-libs = %{samba_depver}
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: libldb = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 
@@ -1128,7 +1180,7 @@ Winexe is a Remote Windows-command executor
 %package -n ctdb
 Summary: A Clustered Database based on Samba's Trivial Database (TDB)
 
-Requires: %{name}-common-libs = %{samba_depver}
+Requires: %{name}-ndr-libs = %{samba_depver}
 Requires: %{name}-client-libs = %{samba_depver}
 Requires: %{name}-winbind-clients = %{samba_depver}
 
@@ -1204,6 +1256,18 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB
 #endif with clustering
 %endif
 
+%if %{with prometheus}
+
+%package prometheus
+Summary: SMB Prometheus exporter
+Requires: samba = %{samba_depver}
+
+%description prometheus
+Support for exporting metrics via Prometheus
+
+#endif with prometheus
+%endif
+
 ### LIBLDB
 %package -n libldb
 Summary: A schema-less, ldap like, API and database
@@ -1215,7 +1279,6 @@ Requires: libtevent%{?_isa} >= %{tevent_version}
 # /endif without includelibs
 %endif
 
-Provides: bundled(libreplace) = %{samba_depver}
 Obsoletes: libldb < 0:2.10
 Provides: libldb = 0:2.10
 Provides: libldb = %{samba_depver}
@@ -1290,6 +1353,13 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} -
 # Make sure we do not build with heimdal code
 rm -rfv third_party/heimdal
 
+%if %{with testsuite}
+# WARNING: Don't change that for production!
+#
+# Shorten the priviliged dir, as unix sockets only have 108 chars
+sed -i 's/#define WINBINDD_PRIV_SOCKET_SUBDIR.*/#define WINBINDD_PRIV_SOCKET_SUBDIR "wb_priv"/' nsswitch/winbind_struct_protocol.h
+%endif
+
 %build
 %if %{with includelibs}
 %global _talloc_lib ,talloc,pytalloc,pytalloc-util
@@ -1355,6 +1425,8 @@ if [ -n "${CCACHE}" ]; then
 fi
 %endif
 
+# workaround https://gitlab.com/ita1024/waf/-/issues/2472
+export PYTHONARCHDIR=%{python3_sitearch}
 %configure \
         --enable-fhs \
         --with-piddir=/run \
@@ -1394,6 +1466,12 @@ fi
 %endif
 %if %{with etcd_mutex}
         --enable-etcd-reclock \
+%endif
+%if %{with prometheus}
+        --with-prometheus-exporter \
+%endif
+%if %{with varlink}
+        --with-systemd-userdb \
 %endif
         --with-profiling-data \
         --with-systemd \
@@ -1439,6 +1517,7 @@ install -d -m 0755 %{buildroot}/var/lib/samba/sysvol
 install -d -m 0755 %{buildroot}/var/lib/samba/usershares
 install -d -m 0755 %{buildroot}/var/lib/samba/winbindd_privileged
 install -d -m 0755 %{buildroot}/var/log/samba/old
+install -d -m 0755 %{buildroot}/run/ctdb
 install -d -m 0755 %{buildroot}/run/samba
 install -d -m 0755 %{buildroot}/run/winbindd
 install -d -m 0755 %{buildroot}/%{_libdir}/samba
@@ -1572,20 +1651,37 @@ touch %{buildroot}%{_libexecdir}/ctdb/statd_callout
 # in the timestamp so the year 2038 problem is deferred till 2446.
 # https://bugzilla.samba.org/show_bug.cgi?id=14546
 #
-for t in samba3.smb2.timestamps.time_t_15032385535 \
-         samba3.smb2.timestamps.time_t_10000000000 \
-         samba3.smb2.timestamps.time_t_4294967295 \
-         ; do
-    echo "^$t" >> selftest/knownfail.d/fedora.%{dist}
-done
-cat selftest/knownfail.d/fedora.%{dist}
+if [ "$(df --portability --print-type "$(pwd)" | grep -c ext4)" == "1" ]; then
+    cat > selftest/knownfail.d/fedora%{dist} << EOF
+^samba3.smb2.timestamps.time_t_15032385535
+^samba3.smb2.timestamps.time_t_10000000000
+^samba3.smb2.timestamps.time_t_4294967295
+EOF
+fi
+
+echo
+echo "Content of selftest/knownfail.d/fedora%{dist}:"
+cat selftest/knownfail.d/fedora%{dist} || true
+
+cat >> selftest/skip << EOF
+# FIXME: Investigate why it fails. Might be CUPS is not running?
+^samba3.rpc.spoolss.printserver
+EOF
+
+echo
+echo "Content of selftest/skip:"
+cat selftest/skip
 
 export TDB_NO_FSYNC=1
 export NMBD_DONT_LOG_STDOUT=1
 export SMBD_DONT_LOG_STDOUT=1
 export WINBINDD_DONT_LOG_STDOUT=1
 export SAMBA_DCERPCD_DONT_LOG_STDOUT=1
+%if "x%{?SAMBA_TESTS}" != "x"
+%{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 TESTS="%{SAMBA_TESTS}"
+%else
 %{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1
+%endif
 #endif with testsuite
 %endif
 
@@ -1631,7 +1727,7 @@ fi
 
 %ldconfig_scriptlets client-libs
 
-%ldconfig_scriptlets common-libs
+%ldconfig_scriptlets ndr-libs
 
 %if %{with dc}
 %ldconfig_scriptlets dc-libs
@@ -1925,33 +2021,104 @@ fi
 #endif with includelibs
 %endif
 
+### CORE-LIBS
+%files core-libs
+%dir %{_libdir}/samba
+
+#
+# Tier 0: Private libraries - libc only dependencies
+#
+%{_libdir}/samba/libreplace-private-samba.so
+%{_libdir}/samba/libsocket-blocking-private-samba.so
+%{_libdir}/samba/libsys-rw-private-samba.so
+%{_libdir}/samba/libtime-basic-private-samba.so
+
+#
+# Tier 1: Private libraries - system libs (libtalloc, libsystemd)
+#
+%{_libdir}/samba/libsamba-debug-private-samba.so
+%{_libdir}/samba/libserver-role-private-samba.so
+
+#
+# Tier 1: Public libraries - system libs (libtalloc)
+#
+%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}*
+
+#
+# Tier 2: Private libraries - adds gnutls
+#
+%{_libdir}/samba/libgenrand-private-samba.so
+
+#
+# Tier 2: Public libraries - adds gnutls, icu, tevent
+#
+%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}*
+%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}*
+
+### NDR-LIBS
+%files ndr-libs
+
+#
+# Core NDR library
+#
+%{_libdir}/libndr.so.%{libndr_so_version}*
+
+#
+# Tier 0: libc only dependencies
+#
+%{_libdir}/samba/libutil-setid-private-samba.so
+%{_libdir}/samba/libutil-tdb-private-samba.so
+
+#
+# Tier 1: system libs only (libtalloc)
+#
+%{_libdir}/samba/libiov-buf-private-samba.so
+%{_libdir}/samba/libstable-sort-private-samba.so
+%{_libdir}/samba/libtalloc-report-private-samba.so
+%{_libdir}/samba/libtalloc-report-printf-private-samba.so
+
+#
+# Tier 2: depends on core-libs (debug, replace)
+#
+%{_libdir}/samba/libflag-mapping-private-samba.so
+%{_libdir}/samba/libinterfaces-private-samba.so
+%{_libdir}/samba/libtdb-wrap-private-samba.so
+
+#
+# Tier 3: depends on core-libs (util, errors, ndr)
+#
+%{_libdir}/samba/libdbwrap-private-samba.so
+%{_libdir}/samba/libsamba3-util-private-samba.so
+%{_libdir}/samba/libutil-reg-private-samba.so
+
+#
+# Tier 4: depends on core-libs + Tier 3 libs
+#
+%{_libdir}/samba/libsamba-security-private-samba.so
+
+#
+# NDR encoding libraries
+#
+%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}*
+%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}*
+%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}*
+
 ### CLIENT-LIBS
 %files client-libs
 %{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}*
 %{_libdir}/libdcerpc-server-core.so.%{libdcerpc_server_core_so_version}*
 %{_libdir}/libdcerpc.so.%{libdcerpc_so_version}*
-%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}*
-%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}*
-%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}*
-%{_libdir}/libndr.so.%{libndr_so_version}*
 %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}*
-%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}*
 %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}*
 %{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}*
-%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}*
 %{_libdir}/libsamdb.so.%{libsamdb_so_version}*
 %{_libdir}/libsmbconf.so.%{libsmbconf_so_version}*
 %{_libdir}/libsmbldap.so.%{libsmbldap_so_version}*
-%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}*
-
-%dir %{_libdir}/samba
 %{_libdir}/samba/libCHARSET3-private-samba.so
 %{_libdir}/samba/libMESSAGING-SEND-private-samba.so
-%{_libdir}/samba/libMESSAGING-private-samba.so
 %{_libdir}/samba/libaddns-private-samba.so
 %{_libdir}/samba/libads-private-samba.so
 %{_libdir}/samba/libasn1util-private-samba.so
-%{_libdir}/samba/libauth-private-samba.so
 %{_libdir}/samba/libauthkrb5-private-samba.so
 %{_libdir}/samba/libcli-cldap-private-samba.so
 %{_libdir}/samba/libcli-ldap-common-private-samba.so
@@ -1964,20 +2131,12 @@ fi
 %{_libdir}/samba/libcluster-private-samba.so
 %{_libdir}/samba/libcmdline-contexts-private-samba.so
 %{_libdir}/samba/libcommon-auth-private-samba.so
-%{_libdir}/samba/libctdb-event-client-private-samba.so
-%{_libdir}/samba/libdbwrap-private-samba.so
 %{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so
 %{_libdir}/samba/libdcerpc-samba-private-samba.so
 %{_libdir}/samba/libevents-private-samba.so
-%{_libdir}/samba/libflag-mapping-private-samba.so
-%{_libdir}/samba/libgenrand-private-samba.so
 %{_libdir}/samba/libgensec-private-samba.so
-%{_libdir}/samba/libgpext-private-samba.so
-%{_libdir}/samba/libgpo-private-samba.so
 %{_libdir}/samba/libgse-private-samba.so
 %{_libdir}/samba/libhttp-private-samba.so
-%{_libdir}/samba/libinterfaces-private-samba.so
-%{_libdir}/samba/libiov-buf-private-samba.so
 %{_libdir}/samba/libkrb5samba-private-samba.so
 %{_libdir}/samba/libldbsamba-private-samba.so
 %{_libdir}/samba/liblibcli-lsa3-private-samba.so
@@ -1990,41 +2149,36 @@ fi
 %{_libdir}/samba/libmsrpc3-private-samba.so
 %{_libdir}/samba/libndr-samba-private-samba.so
 %{_libdir}/samba/libndr-samba4-private-samba.so
-%{_libdir}/samba/libnet-keytab-private-samba.so
 %{_libdir}/samba/libnetif-private-samba.so
+%if 0%{?rhel}
+%{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so
+%{_libdir}/samba/libngtcp2-private-samba.so
+%endif
 %{_libdir}/samba/libnpa-tstream-private-samba.so
-%{_libdir}/samba/libposix-eadb-private-samba.so
-%{_libdir}/samba/libprinter-driver-private-samba.so
-%{_libdir}/samba/libprinting-migrate-private-samba.so
-%{_libdir}/samba/libreplace-private-samba.so
+%{_libdir}/samba/libquic-private-samba.so
 %{_libdir}/samba/libregistry-private-samba.so
 %{_libdir}/samba/libsamba-cluster-support-private-samba.so
-%{_libdir}/samba/libsamba-debug-private-samba.so
 %{_libdir}/samba/libsamba-modules-private-samba.so
-%{_libdir}/samba/libsamba-security-private-samba.so
+%{_libdir}/samba/libsamba-security-trusts-private-samba.so
 %{_libdir}/samba/libsamba-sockets-private-samba.so
-%{_libdir}/samba/libsamba3-util-private-samba.so
 %{_libdir}/samba/libsamdb-common-private-samba.so
 %{_libdir}/samba/libsecrets3-private-samba.so
 %{_libdir}/samba/libserver-id-db-private-samba.so
-%{_libdir}/samba/libserver-role-private-samba.so
-%{_libdir}/samba/libsmb-transport-private-samba.so
 %{_libdir}/samba/libsmbclient-raw-private-samba.so
-%{_libdir}/samba/libsmbd-base-private-samba.so
 %{_libdir}/samba/libsmbd-shim-private-samba.so
-%{_libdir}/samba/libsmbldaphelper-private-samba.so
-%{_libdir}/samba/libstable-sort-private-samba.so
-%{_libdir}/samba/libsys-rw-private-samba.so
-%{_libdir}/samba/libsocket-blocking-private-samba.so
-%{_libdir}/samba/libtalloc-report-printf-private-samba.so
-%{_libdir}/samba/libtalloc-report-private-samba.so
-%{_libdir}/samba/libtdb-wrap-private-samba.so
-%{_libdir}/samba/libtime-basic-private-samba.so
-%{_libdir}/samba/libtorture-private-samba.so
-%{_libdir}/samba/libutil-crypt-private-samba.so
-%{_libdir}/samba/libutil-reg-private-samba.so
-%{_libdir}/samba/libutil-setid-private-samba.so
-%{_libdir}/samba/libutil-tdb-private-samba.so
+
+#
+# Command line library
+#
+%{_libdir}/samba/libcmdline-private-samba.so
+
+#
+# Password database modules (depend on libsamba-passdb)
+#
+%dir %{_libdir}/samba/ldb
+%dir %{_libdir}/samba/pdb
+%{_libdir}/samba/pdb/smbpasswd.so
+%{_libdir}/samba/pdb/tdbsam.so
 
 %if %{without libwbclient}
 %{_libdir}/samba/libwbclient.so.*
@@ -2075,18 +2229,6 @@ fi
 %{_mandir}/man5/smbpasswd.5*
 %{_mandir}/man7/samba.7*
 
-### COMMON-LIBS
-%files common-libs
-# common libraries
-%{_libdir}/samba/libcmdline-private-samba.so
-
-%dir %{_libdir}/samba/ldb
-
-%dir %{_libdir}/samba/pdb
-%{_libdir}/samba/pdb/ldapsam.so
-%{_libdir}/samba/pdb/smbpasswd.so
-%{_libdir}/samba/pdb/tdbsam.so
-
 ### COMMON-TOOLS
 %files common-tools
 %{_bindir}/net
@@ -2103,6 +2245,7 @@ fi
 %{_mandir}/man8/net.8*
 %{_mandir}/man8/pdbedit.8*
 %{_mandir}/man8/smbpasswd.8*
+%{_datadir}/locale/*/LC_MESSAGES/net.mo
 
 ### TOOLS
 %files tools
@@ -2180,6 +2323,7 @@ fi
 %{_libdir}/samba/ldb/subtree_delete.so
 %{_libdir}/samba/ldb/subtree_rename.so
 %{_libdir}/samba/ldb/tombstone_reanimate.so
+%{_libdir}/samba/ldb/trust_notify.so
 %{_libdir}/samba/ldb/unique_object_sids.so
 %{_libdir}/samba/ldb/update_keytab.so
 %{_libdir}/samba/ldb/vlv.so
@@ -2225,6 +2369,7 @@ fi
 %{_libdir}/samba/service/dns.so
 %{_libdir}/samba/service/dns_update.so
 %{_libdir}/samba/service/drepl.so
+%{_libdir}/samba/service/ft_scanner.so
 %{_libdir}/samba/service/kcc.so
 %{_libdir}/samba/service/kdc.so
 %{_libdir}/samba/service/ldap.so
@@ -2440,6 +2585,28 @@ fi
 %{_libdir}/samba/libRPC-SERVER-LOOP-private-samba.so
 %{_libdir}/samba/libRPC-WORKER-private-samba.so
 
+#
+# Server-side libraries (not used by libsmbclient)
+#
+%{_libdir}/samba/libauth-private-samba.so
+%{_libdir}/samba/libctdb-event-client-private-samba.so
+%{_libdir}/samba/libgpext-private-samba.so
+%{_libdir}/samba/libgpo-private-samba.so
+%{_libdir}/samba/libMESSAGING-private-samba.so
+%{_libdir}/samba/libnet-keytab-private-samba.so
+%{_libdir}/samba/libposix-eadb-private-samba.so
+%{_libdir}/samba/libprinter-driver-private-samba.so
+%{_libdir}/samba/libprinting-migrate-private-samba.so
+%{_libdir}/samba/libsmbd-base-private-samba.so
+%{_libdir}/samba/libsmbldaphelper-private-samba.so
+%{_libdir}/samba/libtorture-private-samba.so
+%{_libdir}/samba/libutil-crypt-private-samba.so
+
+#
+# Password database modules (server-side, links to libsmbldaphelper)
+#
+%{_libdir}/samba/pdb/ldapsam.so
+
 ### LIBNETAPI
 %files -n libnetapi
 %{_libdir}/libnetapi.so.%{libnetapi_so_version}*
@@ -2577,6 +2744,7 @@ fi
 %{python3_sitearch}/samba/dcerpc/atsvc.*.so
 %{python3_sitearch}/samba/dcerpc/auth.*.so
 %{python3_sitearch}/samba/dcerpc/base.*.so
+%{python3_sitearch}/samba/dcerpc/bcrypt_rsakey_blob.*.so
 %{python3_sitearch}/samba/dcerpc/claims.*.so
 %{python3_sitearch}/samba/dcerpc/conditional_ace.*.so
 %{python3_sitearch}/samba/dcerpc/dcerpc.*.so
@@ -2592,6 +2760,7 @@ fi
 %{python3_sitearch}/samba/dcerpc/idmap.*.so
 %{python3_sitearch}/samba/dcerpc/initshutdown.*.so
 %{python3_sitearch}/samba/dcerpc/irpc.*.so
+%{python3_sitearch}/samba/dcerpc/keycredlink.*.so
 %{python3_sitearch}/samba/dcerpc/krb5ccache.*.so
 %{python3_sitearch}/samba/dcerpc/krb5pac.*.so
 %{python3_sitearch}/samba/dcerpc/lsa.*.so
@@ -2613,6 +2782,7 @@ fi
 %{python3_sitearch}/samba/dcerpc/spoolss.*.so
 %{python3_sitearch}/samba/dcerpc/srvsvc.*.so
 %{python3_sitearch}/samba/dcerpc/svcctl.*.so
+%{python3_sitearch}/samba/dcerpc/tpm20_rsakey_blob.*.so
 %{python3_sitearch}/samba/dcerpc/unixinfo.*.so
 %{python3_sitearch}/samba/dcerpc/winbind.*.so
 %{python3_sitearch}/samba/dcerpc/windows_event_ids.*.so
@@ -3116,6 +3286,7 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/auth_log_netlogon_bad_creds.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/auth_log_samlogon.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/auth_log_winbind.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/bcrypt_rsakey_blob.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/common.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/complex_expressions.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/compression.*.pyc
@@ -3157,6 +3328,7 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/hostconfig.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/imports.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/key_credential_link.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc
@@ -3234,6 +3406,7 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/subunitrun.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/tdb_util.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/token_factory.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/tpm20_rsakey_blob.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/upgrade.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/upgradeprovision.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/upgradeprovisionneeddc.*.pyc
@@ -3251,6 +3424,7 @@ fi
 %{python3_sitearch}/samba/tests/auth_log_pass_change.py
 %{python3_sitearch}/samba/tests/auth_log_samlogon.py
 %{python3_sitearch}/samba/tests/auth_log_winbind.py
+%{python3_sitearch}/samba/tests/bcrypt_rsakey_blob.py
 %dir %{python3_sitearch}/samba/tests/blackbox
 %{python3_sitearch}/samba/tests/blackbox/__init__.py
 %dir %{python3_sitearch}/samba/tests/blackbox/__pycache__
@@ -3413,6 +3587,7 @@ fi
 %{python3_sitearch}/samba/tests/kcc/graph_utils.py
 %{python3_sitearch}/samba/tests/kcc/kcc_utils.py
 %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py
+%{python3_sitearch}/samba/tests/key_credential_link.py
 %dir %{python3_sitearch}/samba/tests/krb5
 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__
 %{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc
@@ -3528,6 +3703,12 @@ fi
 %{python3_sitearch}/samba/tests/net_join_no_spnego.py
 %{python3_sitearch}/samba/tests/net_join.py
 %{python3_sitearch}/samba/tests/netlogonsvc.py
+%dir %{python3_sitearch}/samba/tests/nss
+%dir %{python3_sitearch}/samba/tests/nss/__pycache__
+%{python3_sitearch}/samba/tests/nss/__pycache__/base.*.pyc
+%{python3_sitearch}/samba/tests/nss/__pycache__/group.*.pyc
+%{python3_sitearch}/samba/tests/nss/base.py
+%{python3_sitearch}/samba/tests/nss/group.py
 %{python3_sitearch}/samba/tests/ntacls.py
 %{python3_sitearch}/samba/tests/ntacls_backup.py
 %{python3_sitearch}/samba/tests/ntlmdisabled.py
@@ -3688,10 +3869,21 @@ fi
 %{python3_sitearch}/samba/tests/subunitrun.py
 %{python3_sitearch}/samba/tests/tdb_util.py
 %{python3_sitearch}/samba/tests/token_factory.py
+%{python3_sitearch}/samba/tests/tpm20_rsakey_blob.py
 %{python3_sitearch}/samba/tests/upgrade.py
 %{python3_sitearch}/samba/tests/upgradeprovision.py
 %{python3_sitearch}/samba/tests/upgradeprovisionneeddc.py
 %{python3_sitearch}/samba/tests/usage.py
+%dir %{python3_sitearch}/samba/tests/varlink
+%dir %{python3_sitearch}/samba/tests/varlink/__pycache__
+%{python3_sitearch}/samba/tests/varlink/__pycache__/base.*.pyc
+%{python3_sitearch}/samba/tests/varlink/__pycache__/getgrouprecord.*.pyc
+%{python3_sitearch}/samba/tests/varlink/__pycache__/getmemberships.*.pyc
+%{python3_sitearch}/samba/tests/varlink/__pycache__/getuserrecord.*.pyc
+%{python3_sitearch}/samba/tests/varlink/base.py
+%{python3_sitearch}/samba/tests/varlink/getgrouprecord.py
+%{python3_sitearch}/samba/tests/varlink/getmemberships.py
+%{python3_sitearch}/samba/tests/varlink/getuserrecord.py
 %{python3_sitearch}/samba/tests/xattr.py
 
 ### TEST
@@ -3712,7 +3904,6 @@ fi
 %if %{with dc}
 %{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so
 %endif
-%{_libdir}/samba/libdsdb-module-private-samba.so
 
 ### USERSHARES
 %files usershares
@@ -3760,6 +3951,7 @@ fi
 %config(noreplace) %{_sysconfdir}/security/pam_winbind.conf
 %{_mandir}/man5/pam_winbind.conf.5*
 %{_mandir}/man8/pam_winbind.8*
+%{_datadir}/locale/*/LC_MESSAGES/pam_winbind.mo
 
 %if %{with clustering}
 %files -n ctdb
@@ -3909,6 +4101,13 @@ fi
 %{_mandir}/man1/winexe.1.gz
 %endif
 
+%if %{with prometheus}
+%files prometheus
+%{_bindir}/smb_prometheus_endpoint
+%{_mandir}/man8/smb_prometheus_endpoint.8.gz
+#endif with prometheus
+
+%endif
 %files -n libldb
 %license lib/ldb/LICENSE
 %{_libdir}/libldb.so.*

smb.conf.vendor

@@ -18,8 +18,6 @@
 	load printers = yes
 	cups options = raw
 
-	smb3 unix extensions = yes
-
 	# Install samba-usershares package for support
 	include = /etc/samba/usershares.conf
 
@@ -40,7 +38,8 @@
 [print$]
 	comment = Printer Drivers
 	path = /var/lib/samba/drivers
-	write list = @printadmin root
-	force group = @printadmin
+	# printadmin is a local group
+	write list = printadmin root
+	force group = printadmin
 	create mask = 0664
 	directory mask = 0775

sources

@@ -1,2 +1,2 @@
-SHA512 (samba-4.22.7.tar.xz) = b06ef2893d302e0bdb6b137f70e46ba35e2b7daf1ab7f97880fee430170ecad4c4faa188e6193ff39a4475143770bc37d9145935994fceb903f826442a92b6b5
-SHA512 (samba-4.22.7.tar.asc) = 6fb05d0cc13ff0e82d9eda3ac94a34e7ac124fd9348e9462bf1662f37c58cd093aa91d3aed8e0ecbf76436a39f011b3b21162c03e6cb3a76fc7d79d244588fca
+SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac
+SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce

tests/deps-check.fmf

@@ -0,0 +1,22 @@
+summary: Check samba package dependency structure
+description: |
+    Verify that samba library packages maintain correct dependency hierarchy:
+    - samba-core-libs has no samba-*-libs dependencies
+    - samba-ndr-libs depends on samba-core-libs (not samba-client-libs or samba-libs)
+    - samba-client-libs depends on core-libs + ndr-libs (not samba-libs)
+    - samba-client depends on samba-client-libs (not samba-libs)
+    - samba-libs does not depend on samba-dc-libs
+    - libsmbclient depends on samba-client-libs (not samba-libs)
+    - libwbclient has no samba-*-libs dependencies
+    - libldb has no samba-*-libs dependencies
+test: ./deps-check.sh
+framework: shell
+require:
+  - samba-core-libs
+  - samba-ndr-libs
+  - samba-client-libs
+  - samba-libs
+  - samba-client
+  - libwbclient
+  - libsmbclient
+  - libldb

tests/deps-check.sh

@@ -0,0 +1,167 @@
+#!/bin/bash
+#
+# Samba package dependency structure verification
+#
+# This test ensures that the samba library package dependencies don't regress.
+# The expected hierarchy is:
+#
+#   samba-core-libs    (no samba-*-libs dependencies)
+#        ^
+#        |
+#   samba-ndr-libs     (depends on samba-core-libs only)
+#        ^
+#        |
+#   samba-client-libs  (depends on samba-core-libs + samba-ndr-libs)
+#
+#   libwbclient        (no samba-*-libs dependencies - only links to libc)
+#
+#   samba-client       (depends on samba-client-libs, NOT samba-libs)
+#   libsmbclient       (depends on samba-client-libs, NOT samba-libs)
+#
+# NOTE: This test checks RESOLVED dependencies, not just explicit Requires.
+# A library requirement like 'libfoo.so' is resolved to the package that
+# provides it, ensuring we catch indirect dependencies.
+#
+
+set -e
+
+ERRORS=0
+
+# Get all packages that a package depends on (resolved)
+# This resolves library deps like 'libfoo.so' to actual package names
+get_resolved_deps() {
+    local pkg="$1"
+
+    rpm --query --requires "$pkg" 2>/dev/null | while read -r req; do
+        # Skip rpmlib and config requirements
+        [[ "$req" =~ ^rpmlib ]] && continue
+        [[ "$req" =~ ^config ]] && continue
+        [[ "$req" =~ ^/ ]] && continue
+
+        # Get the package that provides this requirement
+        provider=$(rpm --query --whatprovides "$req" 2>/dev/null | head -1)
+        if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then
+            # Extract just the package name (remove version-release.arch)
+            echo "${provider%%-[0-9]*}"
+        fi
+    done | sort -u
+}
+
+# Check that a package does NOT depend on packages matching a pattern
+# This checks RESOLVED dependencies (what packages actually get pulled in)
+check_no_resolved_dep() {
+    local pkg="$1"
+    local pattern="$2"
+    local description="$3"
+
+    if ! rpm --query "$pkg" &>/dev/null; then
+        echo "SKIP: $pkg not installed"
+        return 0
+    fi
+
+    local bad_deps
+    # Exclude the package itself from the check
+    bad_deps=$(get_resolved_deps "$pkg" | grep -v "^${pkg}$" | grep -E "$pattern" || true)
+
+    if [ -n "$bad_deps" ]; then
+        echo "FAIL: $pkg depends on $description"
+        echo "  Found: $bad_deps"
+        ERRORS=$((ERRORS + 1))
+        return 1
+    fi
+    echo "PASS: $pkg does not depend on $description"
+    return 0
+}
+
+# Check that a package DOES depend on a specific package
+check_has_resolved_dep() {
+    local pkg="$1"
+    local expected="$2"
+
+    if ! rpm --query "$pkg" &>/dev/null; then
+        echo "SKIP: $pkg not installed"
+        return 0
+    fi
+
+    if get_resolved_deps "$pkg" | grep -qF "$expected"; then
+        echo "PASS: $pkg depends on $expected"
+        return 0
+    fi
+    echo "FAIL: $pkg does not depend on $expected"
+    ERRORS=$((ERRORS + 1))
+    return 1
+}
+
+echo "=== Samba Package Dependency Checks ==="
+echo ""
+echo "Checking resolved dependencies (library deps resolved to packages)"
+echo ""
+
+# 1. samba-core-libs must NOT depend on any samba-*-libs packages
+echo "--- samba-core-libs ---"
+check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba*-libs package"
+
+echo ""
+
+# 2. samba-ndr-libs must depend on samba-core-libs
+#    but NOT samba-client-libs or samba-libs
+echo "--- samba-ndr-libs ---"
+check_has_resolved_dep samba-ndr-libs "samba-core-libs"
+check_no_resolved_dep samba-ndr-libs "^samba-client-libs$" "samba-client-libs"
+check_no_resolved_dep samba-ndr-libs "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 3. samba-client-libs must depend on samba-core-libs and samba-ndr-libs
+#    but NOT samba-libs
+echo "--- samba-client-libs ---"
+check_has_resolved_dep samba-client-libs "samba-core-libs"
+check_has_resolved_dep samba-client-libs "samba-ndr-libs"
+check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 4. libwbclient must NOT depend on any samba-*-libs packages
+echo "--- libwbclient ---"
+check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba*-libs package"
+
+echo ""
+
+# 5. samba-client must depend on samba-client-libs but NOT samba-libs
+#    (client tools should not pull in server libraries)
+echo "--- samba-client ---"
+check_has_resolved_dep samba-client "samba-client-libs"
+check_no_resolved_dep samba-client "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 6. libsmbclient must depend on samba-client-libs but NOT samba-libs
+#    (SMB client library should not pull in server libraries)
+echo "--- libsmbclient ---"
+check_has_resolved_dep libsmbclient "samba-client-libs"
+check_no_resolved_dep libsmbclient "^samba-libs$" "samba-libs"
+
+echo ""
+
+# 7. libldb must NOT depend on any samba-*-libs packages
+#    (libldb is a standalone database library)
+echo "--- libldb ---"
+check_no_resolved_dep libldb "^samba-.*-libs$" "any samba*-libs package"
+
+echo ""
+
+# 8. samba-libs must NOT depend on samba-dc-libs
+#    (server libraries should not pull in DC-specific libraries)
+echo "--- samba-libs ---"
+check_no_resolved_dep samba-libs "^samba-dc-libs$" "samba-dc-libs"
+
+echo ""
+echo "=== Summary ==="
+
+if [ $ERRORS -gt 0 ]; then
+    echo "FAILED: $ERRORS dependency check(s) failed"
+    exit 1
+fi
+
+echo "All dependency checks passed"
+exit 0